Pete Rowley

Paul Madsen has spoken on the SAML Enhanced Client Profile and his verdict is it’s like a donut. Now far be it from me to contradict Paul and his immeasurable skills in producing professional looking diagrams, but perhaps he should note the words of Mark Wahl in his comment that it looks like it “might have a ‘hole’ at its very center where it does not provide coverage?”

Paul, I suggest using carrots. Nice high profile colour, tapered end useful for zeroing in on the axis position, no holes.

The Liberty Alliance made a bold statement in Vancouver last week when it opened its doors for the first time to the hoi polloi. Now this was something interesting enough to demand a visit in of itself, but with the addition of an Open Space after the Liberty meeting, well, you knew I was going to be there right?

The first two days consisted of the regular business of the Liberty Alliance where visitors were allowed to attend any session except for the super secret board stuff. I attended many of the technical sessions which were interesting, though sometimes hard to follow as an outsider without access to the documents under consideration. I also took part in a session around privacy concerns that not only assured me that Liberty has them but that they are serious about dealing with the issues. The conversation turned at one point to outside perceptions of Liberty itself and its lack of openess to its internal process and draft documents. Somewhat ironic was the point made that nowhere was there to be found any information regarding the location of the Liberty conference, at least not to those without access to internal websites. A consequence of this being the first open meeting no doubt. In all, an interesting and worthy meeting.

The final two days were spent on the Open Space which was run in unconference format by Kaliya Hamlin and was excellent as usual. Topics ranged from SAML to Liberty People Service to how should we rename this user centric identity thing? Kim Cameron wrapped up with a lunchtime introduction to CardSpace that by popular demand lasted for nearly two hours. At one point Kim was asked whether Apple would have an identity selector like CardSpace and Kim redirected the question to me in my capacity as OSIS representative. As the newly appointed unofficial spokesman for Apple I suggested that if Steve Jobs would call me I’d hook him up.

So Steve, call me.

I have been at the Burton Catalyst this week. At the reception I was discussing with Paul Trevithick about how I define user-centric identity. The phrase I use is “the people are in the protocol.” Though I wasn’t expecting it, the next day Paul was on a panel when he was asked what user-centric identity was and he quoted me. Cool, but then the next day another panel was asked about the quote and whether having people in the protocol was just a way of excluding other protocols and groups. Well since I wasn’t on the panel to answer that I thought I would take the opportunity to do so here.

When I say protocol I mean it in its broadest sense, in the sense that showing my driving license to a cop at a traffic stop and the cop returning it to me is a protocol. In that transaction I am in possession of the information, I have full knowledge of what information I would pass along to the cop, and I also have the choice of saying no - even if that might result in bad things happening. So people in the protocol means that rather than being an end node that may begin a transaction and perhaps be the recipient of the end results but with only vague or even no information about the information passed in the transaction, they are rather a conduit for all identity decisions in an environment of informed consent. This necessarily means that the protocol must pass through the user, or in other words appear on the screen and be approved by the user. That is an architectural philosophy that results from Kim Cameron’s laws of identity and it is a necessary one in order to gain user buy in. It is also just the right thing to do.

It turns out that it really isn’t hard to architect identity systems to include freedom and choice, but it might not be what one would create if the issue were never considered. It is also not too difficult to re-architect to take account of the philosophy - some work has already begun in SAML for example. Putting people in the protocol is the first step towards providing a scaleable identity framework that takes account of the requirements of the important part - the person. The first step towards treating the users of identity systems with respect.

Paul Madsen has blogged about the recent SAML profile that dials down the security requirements for low risk use cases. The profile is a worthy effort and I welcome the attempt to lower the barriers for adoption in domains where full crypto means no deployment. However, Paul concludes:

I don’t know just how much effort was expanded by Scott & Jeff on this work - I do know that far more would have been required to be “adding” security at this point.

As is true for haircuts - you get into trouble if you take too much off the first time.

Hey Paul, hair grows. Check out the fine mop that I sport. If I had waited until that monster had matured before being born I would have had trouble getting adopted too. Therefore I must conclude that Paul has a secret yearning to be a hairdresser since on the rare occasion I visit one they all but refuse to cut my hair too. It really is like a bad ui:

“Are you sure you want me to cut your hair?”